{"id":100168,"date":"2021-05-14T16:23:07","date_gmt":"2021-05-14T14:23:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux"},"modified":"2021-05-14T16:23:07","modified_gmt":"2021-05-14T14:23:07","slug":"uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-podsisteme-ebpf-pozvolyayushhie-vypolnit-kod-na-urovne-yadra-linux","title":{"rendered":"Vulnerabilities in the eBPF subsystem that allow code execution at the Linux kernel level","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Two new vulnerabilities have been identified in the eBPF subsystem, which allows executing handlers within the Linux kernel in a special virtual machine with JIT. Both vulnerabilities enable the execution of arbitrary code with kernel privileges, outside the isolated eBPF virtual machine. Information about the issues was published by the Zero Day Initiative team, which conducts the Pwn2Own competitions, where this year three attacks on Ubuntu Linux were demonstrated using previously unknown vulnerabilities (it is not reported whether the eBPF vulnerabilities are related to these attacks). <\/p>\n
\n
CVE-2021-3490 \u2014 the vulnerability is caused by the lack of boundary checking of 32-bit values during AND, OR, and XOR bitwise operations in eBPF ALU32. An attacker can exploit this flaw to read and write data outside the allocated buffer boundaries. The issue with the XOR operation appears starting from kernel version 5.7-rc1, and for AND and OR starting from release 5.10-rc1.\n
CVE-2021-3489 \u2014 the vulnerability is caused by an error in the implementation of the ring buffer, related to the fact that the function bpf_ringbuf_reserve did not check if the allocated memory size could be smaller than the actual size of the ring buffer. The issue manifests itself starting from the release 5.8-rc1. <\/ul>\n
The status of vulnerability fixes in distributions can be tracked on these pages: Ubuntu, Debian, RHEL, Fedora, SUSE, Arch. Fixes are also available as patches (CVE-2021-3489, CVE-2021-3490). The exploitability of the issue depends on the user's access to the eBPF system call. For instance, in the default configuration in RHEL, exploitation of the vulnerability requires the user to have CAP_SYS_ADMIN privileges. <\/p>\n
Another noteworthy vulnerability in the Linux kernel is CVE-2021-32606, which allows a local user to elevate their privileges to root level. This issue appears starting from Linux kernel 5.11 and is caused by a race condition in the implementation of the CAN ISOTP protocol, which allows the modification of socket binding parameters due to the lack of proper locking in the isotp_setsockopt() function when handling the CAN_ISOTP_SF_BROADCAST flag. <\/p>\n
After closing the ISOTP socket, the binding to the recipient socket continues to operate, which may allow the related structures to be used even after the associated memory has been freed (use-after-free due to accessing the already freed isotp_sock structure when calling isotp_rcv()). By manipulating the data, it is possible to override the pointer to the sk_error_report() function and execute custom code at the kernel level. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"